What is the CVSS score of CVE-2025-52787?

CVE-2025-52787 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-52787

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EZiHosting Tennis Court Bookings tennis-court-bookings allows Reflected XSS.This issue affects Tennis Court Bookings: from n/a through <= 1.2.7.

AnalysisAI

Reflected cross-site scripting (XSS) in EZiHosting Tennis Court Bookings WordPress plugin through version 1.2.7 allows unauthenticated attackers to inject malicious scripts into web pages viewed by administrators and users. The vulnerability stems from improper input neutralization during page generation, enabling attackers to steal session tokens, redirect users, or perform actions on behalf of victims through crafted URLs. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Tennis Court Bookings plugin (WordPress plugin identified via Patchstack database) fails to properly sanitize user-supplied input before rendering it in dynamically generated web pages. This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where untrusted data from URL parameters or form submissions is echoed back to the browser without encoding or validation. The vulnerability affects the plugin across all versions from initial release through version 1.2.7. WordPress plugins are PHP-based extensions that extend WordPress functionality; when they fail to escape output, they create XSS attack surface within the WordPress admin dashboard and public-facing pages. The plugin likely uses direct parameter rendering in templates without leveraging WordPress security functions like wp_kses_post() or esc_html().

Affected ProductsAI

EZiHosting Tennis Court Bookings WordPress plugin is affected in all versions from initial release through and including version 1.2.7. The plugin is distributed via the WordPress plugin repository and identified in the Patchstack vulnerability database.

RemediationAI

Update the Tennis Court Bookings plugin to a patched version released after 1.2.7. WordPress administrators should navigate to Plugins > Installed Plugins and click Update if available, or remove the plugin if no patched version is available. As a temporary workaround pending plugin update, restrict access to the plugin's functionality to trusted administrators only via WordPress user role management, or disable the plugin entirely if not actively used. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tennis-court-bookings/vulnerability/wordpress-tennis-court-bookings-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve for the specific patched version number and additional guidance.